CveMateVulnerability intelligence

CVE-2007-4033: php

CVSS: 7.5v2.0HighModified

AliasesDSA-1390-1

Published 27-07-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-4033 is a high (CVSS 7.5) vulnerability in php. EPSS estimates a 18.66% chance of exploitation in the next 30 days, higher than 97.2% of scored vulnerabilities. 3 public exploits are recorded.

Overall risk

44/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v2.0 (NVD)

EPSS score

18.66%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits3reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 3

RHSA-2007:1027 RHSA-2007:1030 RHSA-2007:1031

Timeline

27-07-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

CVSS metrics

1 score · 1 source · 1 version

v2.07.5

EPSS trend

Probability

18.66%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 18.66% on 18-09-2026

18-09-202618-10-2026

EPSS score

18.66%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

3 found

referenceUnverified
Exploit Reference (securityfocus.com)
Maturity: unknown
exploit-databasedosphpVerified
T1lib - 'intT1_Env_GetCompletePath' Buffer Overflow (PoC)
Maturity: poc
exploit-databasedoswindowsVerified
PHP 5.2.3 - 'PHP_gd2.dll' imagepsloadfont Local Buffer Overflow (PoC)
Maturity: poc

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Debian1 product

t1lib< 5.0.2-3sarge1 | < 5.1.0-2etch1

Php1 product

phpEOL5.2.3

T1lib1 product

t1lib5.1.1

3 vendors · 3 products

References

40 links

security.gentoo.org/glsa/glsa-200710-12.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/27743Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/26901Third Party AdvisoryX Refsource SECUNIAVendor Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10557VDB EntrySignatureX Refsource OVAL
exchange.xforce.ibmcloud.com/vulnerabilities/35620VDB EntryX Refsource XF
fedoranews.org/updates/FEDORA-2007-234.shtmlVendor AdvisoryX Refsource FEDORA
www.securityfocus.com/archive/1/480239/100/100/threadedMailing ListX Refsource BUGTRAQ
www.debian.org/security/2007/dsa-1390Vendor AdvisoryX Refsource DEBIAN
secunia.com/advisories/27297Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200805-13.xmlVendor AdvisoryX Refsource GENTOO

Show all 40 references

www.securityfocus.com/archive/1/485823/100/0/threadedMailing ListX Refsource BUGTRAQ
wiki.rpath.com/wiki/Advisories:rPSA-2008-0007X Refsource CONFIRM
bugzilla.redhat.com/show_bug.cgi?id=303021X Refsource MISC
www.redhat.com/archives/fedora-package-announce/2007-November/msg00724.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/support/errata/RHSA-2007-1031.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDKSA-2007:189Vendor AdvisoryX Refsource MANDRIVA
www.exploit-db.com/exploits/4227ExploitX Refsource EXPLOIT DB
secunia.com/advisories/30168Third Party AdvisoryX Refsource SECUNIA
issues.rpath.com/browse/RPL-1972X Refsource CONFIRM
secunia.com/advisories/27239Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/26241Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/480244/100/100/threadedMailing ListX Refsource BUGTRAQ
www.securityfocus.com/bid/25079VDB EntryX Refsource BIDExploit
secunia.com/advisories/27718Third Party AdvisoryX Refsource SECUNIA
www.bugtraq.ir/adv/t1lib.txtX Refsource MISC
security.gentoo.org/glsa/glsa-200711-34.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/28345Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27599Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.ubuntu.com/usn/usn-515-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/27439Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securitytracker.com/id?1018905VDB EntryX Refsource SECTRACK
www.redhat.com/archives/fedora-package-announce/2007-November/msg00663.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/26981Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-1027.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2007-1030.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDKSA-2007:230Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/26992Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugs.gentoo.org/show_bug.cgi?id=193437X Refsource CONFIRM
www.novell.com/linux/security/advisories/2007_23_sr.htmlVendor AdvisoryX Refsource SUSE
www.securityfocus.com/archive/1/487984/100/0/threadedMailing ListX Refsource BUGTRAQ